Exploiting Intel's Management Engine - <AUTHOR> https://kakaroto.homelinux.net/2019/11/exploiting-intels-management-engine-part-1-understanding-pts-txe-poc/ <comment><USER2> > The ME does have a legitimate function, but it does so much more now, as it > takes care of the hardware initialization, the main CPU boot up, control of > the clock registers, DRM management for Audio/Video, software based TPM and > more.

In other words, the ME is to Intel boards as Apple's T2 chip is to their recent notebooks: an SoC that takes on the real role of being the "system processor", turning the [rest of the] socketed CPU into effectively an "application processor."

In fact, given that it's so self-sufficient, it's interesting that Intel choose to ship the ME as an "IP core" of the CPU itself, rather than making it part of the off-die Intel PCH chipset that they supply to mobo vendors. Is it just to provide the ME with low-latency access to CPU components like ALUs (for TPM encryption circuits) and d-cache (for packet sniffing)? Because it seems like it isn't really built this way, and an "external ME" would be just fine running without a CPU socketed in at all. (Which would be neat, honestly; if you could exploit an external ME, you could run software on your Intel- chipset motherboard without a "real" CPU!)

Given that industry players seem to be all trending toward this design in one way or another (even game consoles did the "system SoC" / "application CPU" split with the last two generations), I wonder if this design pattern will ever be standardized, in the way that interrupt controllers or MMUs were standardized. Will we ever see an open-hardware board with its own open- hardware system-management SoC running FOSS firmware?

<comment><USER3> This has been the case in Server systems for a while - IPMI[1] has been used for remote KVM, power management, remote mounting of ISOs, etc. on many servers for years. HP's iLO, Dell's iDRAC, and even SuperMicro boards have an implementation. This pattern is pretty standard, but none of it's FOSS.

[1][https://en.wikipedia.org/wiki/Intelligent_Platform_Managemen...](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface)

<comment><USER4> Wasn't NordVPN recently pwned via an IPMI security hole?

iLO is kind of a piece of crap, but I do love my Xen and resource pools

<comment><USER5> Pretty sure the IPMI software is crap no matter the brand. I know the SuperMicro one requires a very old Java version fat client to interact with it, and is very flaky.

<comment><USER6> The newer versions finally support a HTML5 console instead of the old java webstart horror they used to ship with.

<comment><USER7> Also, if you need to interact with a Supermicro BMC that doesn't support the HTML5 console (for example, because it's running older firmware), I reverse- engineered the proprietary "iKVM" protocol (along with a lot of other parts of the BMC) and implemented support for it on a branch of noVNC, which you can find here: [https://github.com/kelleyk/noVNC](https://github.com/kelleyk/noVNC)

<comment><USER8> Waaaat! Praise be. Now I can justify the last 45min reading HN...

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> So I keep hearing that the IME can do remote KVM.

I've got an old laptop lying around, could I hook at up to my router and access it without remote desktop software from another PC on my network?

Or does this require some expensive intel software with a subscription?

<comment><USER10> Key words: AMT, vPro. You should have compatible CPU and board. Remote KVM is provided via VNC protocol, so any VNC viewer should work. You need to open web interface and proceed from there.

Basically it's a business feature and usually not available on consumer laptops.

<comment><USER11> And very annoyingly not available on the Intel NUC, even though remote- managing those would be very useful. I guess something about not wanting to canabalise their server market.

If IME could be reprogrammed then maybe there would be a way to add these features.

<comment><USER12> You are looking for NUC7i7DN(HE,KE). These SKUs do have AMT. They also have iSCSI support in UEFI. Yes, nice little machines.

<comment><USER13> Well, AMT looks very tempting because of the functionality.

On the other side because of security, I'm not sure whether I should be glad to use NUC models that don't have it at all.

So assuming I take the risk, what networking link does AMT require? Do I guess correctly that it works only over Ethernet? Thinking of mobile devices that have only a cellular modem link.

<comment><USER12> It works with ethernet and newer versions with wifi. The eth and wifi chips also must be the Intel ones.

</comment></comment></comment></comment></comment></comment><comment><USER3> It is possible to use an Intel machine without the ME. Since there are constant vulnerabilities and exploits around the ME, many enthusiasts do not like the idea of a vulnerable and secret super-admin computer on their computer. There is the option to disable the ME on supported devices (usually old Thinkpads) using me_cleaner[1].

I personally run Coreboot on my Thinkpad with the ME "disabled" (essentially just broken and stuck in a constant bring-up state), and System76[2], Purism[3], and Dell sell machines with the option of disabling the ME entirely, if one is super-paranoid.

[1] [https://github.com/corna/me_cleaner](https://github.com/corna/me_cleaner)

[2] [https://system76.com/laptops](https://system76.com/laptops)

[3] [https://puri.sm/learn/intel-me/](https://puri.sm/learn/intel-me/)

<comment><USER14> I'm confused... other comments reference ME as the root-of-trust for the system, the chip that brings the CPU out of reset. How can a system be operational without that functionality?

<comment><USER15> Why wouldn't it work? Intel-based motherboards didn't always have a ME.

<comment><USER16> Current Intel chipsets and CPUs cannot initialize the system without the ME. You can disable all the applications running on the ME, but it is required to bring up the system.

</comment></comment></comment></comment><comment><USER17> Just wanted to say that this was written really well. As someone who doesn't know anything about the subject, I was easily able to follow along and understand. That's kind of rare around here for me.

</comment><comment><USER18> Seems to be hugged to death.

[https://archive.is/ty7Yu](https://archive.is/ty7Yu)

<comment><USER19> [https://web.archive.org/web/20191115161514/https://kakaroto....](https://web.archive.org/web/20191115161514/https://kakaroto.homelinux.net/2019/11/exploiting- intels-management-engine-part-1-understanding-pts-txe-poc/)

archive.is is nice, but the Wayback Machine makes URLs which are a lot more transparent.

<comment><USER20> archive.is also breaks if you use Cloudflare DNS.</comment></comment></comment>


China can apparently now identify citizens based on the way they walk - <AUTHOR> https://techcrunch.com/2018/11/07/china-can-apparently-now-identify-citizens-based-on-the-way-they-walk/ <comment><USER2> Setting who wants to do this aside in order to avoid the constant 'X is worse than Y' arguments.

I don't think it's unreasonable to assume that in a near future we will have cameras that can do much more than identification on a massive scale. It may be easy to track things like how stressed, healthy, sober etc. people are without their consent or without them even noticing. And this would be _precise_ , not speculative like the current online tracking.

Would you live comfortably in this world? Would you build this?

<comment><USER3> Yup. Think about how you can recognize your friends without even seeing their face, by the way they walk, what they wear, how tall they are, and other contextual clues. Computers will be able to do all of that. Also think about other things that only computers with massive amounts of data will be able to do. Computers will be able to enumerate your wardrobe, your possessions. They'll be able to figure out most of the books you've read or own. They'll know where you work, what your schedule is, where you shop, what you do for fun, when you take vacations and where. They'll be able to learn all of this even if you don't freely give all this information up through social media posts and what-have-you by following you in the background of other stuff or through other "feeds". Imagine how much easier it is to identify someone in a picture or a video if you can pull in "big data" context which narrows down the possible/likely people who could be in that location at that time (wearing those clothes, doing that activity, within a given weight/height range, etc, etc, etc.)

We don't really know what the feasible computational and data limits are here, the potential (and likelihood, I think) is that they are much, much lower than where we would like them to be. In the near future something very close to ubiquitous surveillance is very likely to be the norm. And that has all sorts of chilling implications. If systems can keep track of where you are and what you're doing most hours of most days then that opens up a lot of questions in terms of free expression, political organizing, civil disobedience, etc.

<comment><USER4> Sound like advertiser's heaven. Sign me out please.

</comment></comment></comment><comment><USER5> I made a couple trips to the South Pole in grad school. Down there you were either a scientist in a red parka, black insulated pants, and white boots or support staff in brown carharts. No part of the body could be seen at a distance and even the gloves were standard issue.

What constantly amazed me was how you could see someone walking a quarter mile away and instantly know exactly who it was.

The South Pole is a smaller population than China so I'd be worried about false positives (probably mostly within families as kids learn to stand and walk like their parents and have similar dimensions when fully grown) but I suspect it's actually a pretty robust identification technique.

<comment><USER6> > The South Pole is a smaller population than China so I'd be worried about > false positives

Even if the false positive rate is really low, it's still a problem. All of these dragnet-style things mess with your priors. In a traditional investigation, the police have a handful of suspects and then gather evidence. Circumstantial evidence showing that the chances are 1 in 1000 that this one _of the five suspects_ was not the culprit is pretty convincing, and probably enough to convict.

Cast a dragnet over a city of 1 million, and suddenly that same 1-in-1000 error rate will be giving you 1000 innocent people who, under the old system, are 'guilty beyond reasonable doubt'. They've been pre-selected to look pretty frikkin' bad regardless of whether they're guilty, which means any one of them will have a hell of a time proving their innocence.

<comment><USER7> I suspect there's quite a bit of case law on what probability of false positives is acceptable?

</comment></comment></comment><comment> r-bryan In Cory Doctorow's _Little Brother_, some characters would put pebbles in their shoes so gait-recognizers wouldn't recognize them.

<comment><USER8> That's what real life spies do too

edit : a source : [https://www.youtube.com/watch?v=JASUsVY5YJ8](https://www.youtube.com/watch?v=JASUsVY5YJ8)

<comment><USER9> The relevant time stamps 4:39-5:02.

Former CIA Chief: "Changing the way that you walk requires some amendment to what you're doing. You're going to need a physical apparatus to make you walk differently. You can't possibly say, okay, now I'm going to limp. To change my walk, I put a little piece of gravel in my shoe, just a little thing that pinches my toe, and it changes my walk whether I want to or not. You can put a bandage around a knee, something that restricts you, will change your walk."

</comment></comment></comment><comment><USER10> 1\. Gait detector is functional.

2\. Countermeasure: use stone in the shoe, tape and other things to fool the gait detector.

3\. Counter-countermeasure: detect artificial gaits. Everyone unrecognized with artificial gait is person of interest.

<comment><USER11> 4\. Counter-counter-countermeasure: wheels.

<comment><USER10> 5\. You don't have enough social credit for wheels.

</comment></comment></comment><comment><USER12> This will cause people to start walking on the street in the same way as Fremen in Frank Herbert's Dune, by varying frequency and step length in order not to attract a (government) worm.

<comment><USER13> I was thinking more Ministry of Silly Walks.

<comment><USER14> Combine it with Morrison's _The Invisibles_.

"Big Brother is watching. Learn to move indescribably."

</comment></comment></comment><comment><USER15> So, my understanding is that the machine vision technologies discussed in this article don't really work that well, at least not once deployed in the real world, outside of "the lab" and away from the controlled conditions of a scientific experiment reported in a research paper.

I wonder, then- do the authorities of the various countries (by far not just China) who make use of this kind of technology know how little they add to their ability to spy on their citizens? If they know- do they use it anyway just so that lucrative contracts can be signed and money exchange hands? Do they (also?) figure that the fear of being identified by all-seeing, all- knowing cameras will keep the population in the straight and narrow, even if the cameras are blind and dumb as bricks, in practice?

</comment><comment><USER16> My Bachelor's (of engineering) thesis was in biometrics and if there's one thing I remember from the seminars it's that gait along with typing rhythm and voice are these modalities that pop up every now and then only to disappear after a while after their proponents figure out that it's no use.

These modalities simply don't carry enough information to reliably identify anyone.

Facial recognition works best when you need the subject to be unaware that they are being identified.

<comment><USER17> You don't necessarily need to identify one amongst 1.3 billion. (requiring 30 bits of information out of the gait!)

The context is a crowd of about 100 (10 - 1000), in which you are tracking a few percent, and you need to keep "eyes" on an individual, discriminating amongst a few others that have crossed is path.

That said, I'd agree that it looks difficult to help distinguish individuals in a trained team.

</comment></comment><comment><USER18> This is not new, and is not unique to China. Any country with intelligence units, like the US, is using data mining to identify and control their citizens. It has become fashionable lately to imply that China is the only country doing these things, or somehow doing it in larger scale. Has everyone forgotten what Snowden revealed?

<comment><USER19> I dont remember anything in the snowden docs about the NSA trying to track the movement of all american citizens.

Comparing what the NSA does to what China does is like comparing the treatment of women in the US and Saudi Arabia

<comment><USER18> Of course, Snowden was only able to review what he saw 5 years ago or more. Why you have any doubts that the NSA, with ample resources to track and control, would use techniques similar to what the Chinese do? Do we really need another Snowden to realize this obvious fact?

<comment><USER20> Because while sure they may be working on any sinister form of control possible, the NSA has to do it in secret, which makes it a bit harder to trample on rights. In China it isn't secret, its just the way things are.

</comment></comment></comment></comment><comment><USER21> Can they tell if I'm a women's man, no time to talk?

</comment><comment><USER22> I'm curious what the false positive rate is on this technology. It seems like a very noisy source to do correlations from.

<comment><USER23> I'm about to walk out the door so I can't look up papers, but I'm going to guess that it's based as much on dynamics as actual proportions of limbs. I would estimate the number of features to be on the scale of 2000-2010 era facial recognition. Dynamics would increase the number of dimensions, making it possible to separate two people with nearly identical features.

However, I do agree that inferring the proportions from video imagery at various angles and with various items of clothing is going to be challenging due to systemic distortion, e.g. inferring incorrect angle due to clothing.

<comment><USER24> If they blanket an area with cameras, as China does, they can use multiple vantage points to get more accurate measurements and, when a positive ID is made, they can persistently track that person crossing from one field of view to another.

I think the main advantage of gait analysis (or limb proportion measurement) is that it will encourage a more efficient, decentralized computation that first distills the observed data into a fingerprint that can be more easily transmitted over a wire to a massive database for matching, rather than the alternatives of either replicating that database or transmitting raw, high- bandwidth data.

Besides limb measurements, they could also use last known location, residence, and vehicle ownership information to increase the certainty of loose matches.

</comment></comment></comment><comment><USER25> One of the books I read when I was younger that got me into programming is Little Brother by Cory Doctorow. In the book, the high school they attend has cameras that identify students by measuring gait. The characters in the book put gravel in their shoes to throw the tech off when cutting class.

</comment><comment><USER26> If this is all out in the open in China and many Chinese people even approve of it, wouldn't it be more efficient to have everyone wear ID tags of some kind?

<comment><USER27> Because those are easier to fake than your face or way of walking. And you want to monitor the people who'd be inclined to fake this.

</comment></comment><comment><USER28> I'm skeptical, especially of the surveillance claims. If you already know who you're looking for and you have lots of footage of that person, you might be able to train your system to pick up that person's gait from new footage. But that's a far cry from being able to "identify anyone" by their gait, i.e. set up lots of cameras around the city and track individuals coming and going.

There are already amazing airborne camera systems that track the motion of every license plate in a city, and even that isn't the same as tracking every car's movement because you still have to know which license plate to follow -- you just can't care about all movement of all cars. I suppose someone will say that you can store all movement in a database, but I'll wager that's just not worth anywhere near the cost. Your computing power would be much better spent on computing large primes.

Anyway, it's a cool sci-fi movie premise. You can see the murderer shaving off his mustache, burning off his own fingerprints and then knee-capping himself to avoid detection.

<comment><USER29> > you just can't care about all movement of all cars

Of course we can. For each license plate encountered by CCTV or cop cars, store a tuple of (timestamp, coordinates). This won't require much disk space, so that's not a concern. Later, it is easy to answer questions like "what places was this car seen and when?" and "which cars were in this vicinity at this time?"

<comment><USER28> Well, let's test your claim. Say there are 1 million cars in a city. Say your camera system covers 300 square miles (to handle nyc). The question is how long would it take to scan the images from a single moment and capture all license plates. At 5 seconds per plate, that's 57 days. Plenty of time to commit a crime and escape without detection. And again, you could've been doing something useful like capturing some large prime numbers, in order to break the encryption of someone who is actually trying to hide something.

<comment><USER30> Why would it take 5 seconds a plate? They could as well station a licence plate reader at each intersection, and update a key-value store with a given plate's last seen location whenever one is spotted. O(1).

<comment><USER28> Parallelization you say? 5 seconds is constant time, and a pretty optimistic one. How many license plates are visible from any given intersection in my town, NYC? Somewhere between 5 and 50. There is always motion, so what should the frame rate be? You probably can't commit much of a crime in 15 seconds, but you can drive an 8th of a mile (at 30 mph), about two intersections. So let's settle on a frame rate of 5 seconds. You still won't have much precision with cameras only at each intersection, so let's put them 10 feet apart, and let's have 4 at each point. Honestly, that's a minimum. At 10 feet apart, for NYCs 6074 miles of road, that's 12,828,288 computerized cameras. That's about $12B. And I still bet that the error rate will be too high to be useful.

I'm not arguing that it will never be possible, I'm arguing that the original claim, and the mass surveillance that make people nervous, is not happening today.

</comment></comment></comment></comment></comment><comment><USER31> This isn't new. Gait recognition has been in use for well over a decade.

</comment><comment><USER32> Mitigation strategies discussed in an unrelated (but relevant) conversation between WIRED and Jonna Mendez - [https://www.youtube.com/watch?v=JASUsVY5YJ8&t=278](https://www.youtube.com/watch?v=JASUsVY5YJ8&t=278) (if you're not auto-jumped, find 4:38 in the video)

<comment><USER33> A url with &t= pretty much always auto-jumps.

</comment></comment><comment><USER34> Anyone who's heavily near-sighted knows this technique. In college, my dorm bathroom was quite a distance from my room. At night, I would remove my contact lenses, and upon returning I would always identify certain people by their style of walking, or their posture.

</comment><comment><USER35> UK has been doing this for decades: [https://www.youtube.com/watch?v=iV2ViNJFZC8](https://www.youtube.com/watch?v=iV2ViNJFZC8)

<comment><USER36> So have casinos.

I was really into the idea of card counting when I was in high school (over 10 years ago) and remember coming across multiple sources that claimed casinos did this as part of their arsenal to detect people who've been blackballed.

</comment></comment><comment><USER37> Surely gait analysis is part of the US arsenal as well. It's unique like a fingerprint and is used extensively by equestrian teams, etc., to detect shoe and health issues early to protect the investment in the horse. Many relevant health problems are visible early on as a change in the horse's gait.

It can be done with an accelerometer or a camera, and probably other kinds of sensors.

It could also be used for early diagnosis in humans, but is cost prohibitive for human preventative care use.

</comment><comment><USER38> Remember a decade or so ago when the U.S. military was icing Middle Eastern "terr'ist" targets based upon gait analysis?

Well, now it's you. And also, once again, brought to "the world" by China. (Maybe they'll sell it along side of or as an add-on to their Great Firewall turnkey systems.)

I remember viewing a few of those old video segments (drone- and plane-based platforms) and feeling pretty nervous.

</comment><comment><USER39> ...says some company.

Yeah right. The sensitivity/specificity requirements for this to be useful would be insanely difficult or impossible to reach.

<comment><USER40> The US government has had this forever. This is why they train you at the farm to put a pebble in your shoe if you're trying to evade detection so your gait changes. It is most certainly not impossible.

<comment><USER41> For others that aren't aware, "The Farm" refers to a CIA training facility at Camp Peary.

[https://en.wikipedia.org/wiki/Camp_Peary](https://en.wikipedia.org/wiki/Camp_Peary)

</comment></comment></comment><comment><USER42> Gait analysis has been around for a LONG time. I saw papers 15 years ago from labs here in the states.

</comment><comment><USER43> How well does gait analysis work against gait-disguise techniques like putting a pebble in your show as described in this video?

[https://www.youtube.com/watch?v=JASUsVY5YJ8](https://www.youtube.com/watch?v=JASUsVY5YJ8)

</comment><comment><USER44> Fake crutches or wheelchairs could also be an interesting foil to this method of surveillance?

</comment><comment><USER45> We should all start skipping in public instead of walking, because we're happy.

<comment><USER46> So.. happy..

> _the kinds of questions that began to present themselves were just.. the > questions themselves were ugly and I didn 't want to know the answers. It's > like banging on a door, you knock on a door, and the door opens slightly and > behind that door it's dark and there's loud noises coming like there's wild > animals in there or something. And you peer into the darknees and you can't > see what's there but you can hear all this ugly stuff.. do you want to step > into that room? No way, you just sorta back out quietly, pull the door shut > behind you, and walk away from it._

\-- Bill Ehrhart ( [https://www.youtube.com/watch?v=tixOyiR8B-8](https://www.youtube.com/watch?v=tixOyiR8B-8) )

<comment><USER47> He was my history teacher in Highschool. He was (and still is) an inspiring orator and incredibly talented poet. His perspective is invaluable and has already proven to be timeless.

</comment></comment></comment><comment><USER48> Amazing that nobody has so far mentioned "Mission Impossible Rogue Nation"! There's a scene where Benji has to pass a corridor where people are identified by the way they walk!

</comment><comment><USER49>
      [Scanning]
      Subject: Woman's man
      Time to talk: None.

</comment><comment><USER50> I remember this being a research topic while I was in grad school more than 10 years ago. Like face recognition, it is nothing unique and is being researched by plenty of people

</comment><comment><USER51> Is this defeated by the stone in shoe gait changing technique?

</comment><comment><USER44> Time for some IR emitting / reflecting pants!

<comment><USER52> curious, how would this prevent being captured on camera? isn't visible light used?

<comment><USER53> If the pants reflect whole spectrum, then it should be reasonably obscured from cameras. I think GP did not mean mere IR reflectiveness.

</comment></comment></comment><comment><USER54> I wonder how hard it would be to fool them by walking differently. Are there parameters you can't change much?

</comment><comment><USER55> The Segway will finally be vindicated.

</comment><comment><USER56> They gonna combine this with facial to get better accuracy

</comment><comment><USER57> There was a science fiction book who talked about putting a rock in your shoe to change your gait and avoid detection.

What was it ?

<comment><USER58> Little Brother, Cory Doctorow. Of course then you just train a network to map between pebbled and unpebbled gaits and run that on any failed matches. So...

<comment><USER58> Actually Double Star did this first back in ... 1954? I loved that book when I first read it.</comment></comment></comment>


The House passes CISPA with a vote of 248 to 168 - <AUTHOR> http://thenextweb.com/us/2012/04/27/the-house-passes-cispa-with-a-vote-of-248-to-168/?utm_source=HackerNews&utm_medium=share%2Bbutton&utm_content=The%20House%20passes%20CISPA%20with%20a%20vote%20of%20248%20to%20168&utm_campaign=social%2Bmedia <comment><USER2> Just a reminder: many (maybe most) of the Dems who voted against CISPA did so because they favor a _more_ intrusive intervention: they want the government to establish standards for "cybersecurity" to apply to private industry systems they consider "critical infrastructure", and then for the government to deputize specific firms (read: Raytheon, SAIC, Lockheed) to conduct mandatory audits of those firms. Privacy is a fig leaf here.

Also remember: under the Electronic Communications Privacy Act of 1986, none of the information disclosure "authorized" by CISPA was already unlawful. 18 USC § 2702 (b) (5): private companies can voluntarily disclose private customer information "as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider of that service". Without limitation. With no check on the what the government does with that information afterwards. CISPA _added_ restrictions (albeit weak ones) on sharing; it didn't meaningfully broaden what could be shared.

Regardless of what EFF says about this (unfortunately, I personally believe EFF's interest in CISPA is largely about fundraising), you probably should be careful about cheering CISPA's demise.

<comment><USER3> Remember, tptacek has very little idea what he is talking about when he posts this same comment on every thread. Doesn't have a clue about the politics; doesn't have a clue about the law. To be charitable. Because he has been informed, and keeps posting this, which turns it from clueless to intentionally lying.

Yes, under ECPA, information can be disclosed "as may be necessarily incident to the rendition of the service", which is to say, not very often, since it's not often necessarily incident, and a company which disclosed your information might have to prove in a court of law that it was necessarily incident. Which is a rather big limitation, as opposed to tptacek's lying characterization of it as "without limitation".

I don't really understand tptacek's position here - is he being paid for this? - but this repeated bullshit posting needs to stop. (And the evil-Democrat- vs.-noble-Republican stuff is pure fantasyland. CISPA isn't about cybersecurity as computer professionals think of it. It's about copyright enforcement and general government snooping, not about hacking. Both Democrats and Republicans are fully behind it, despite the political wrangling, assuming that the copyright lobby has made the proper campaign contributions this year.)

<comment><USER4> Is there a way to make your point without the ad-hominem or the accusations, and with more references? You've accused him of deliberately and repeatedly lying (a pretty serious accusation for one of the top HN contributors); do you have any evidence besides your differing interpretation of his citation?

(And I still do _not_ see how it is at all related to copyright.)

<comment><USER5> not commenting about the other issues, but CISPA grants legal immunity if

"theft or misappropriation of private or government information, intellectual property, or personally identifiable information." (exact quote from the text of the bill)

is thought to be occurring, and information is shared, it is very much related to copyright.

<comment><USER2> It is likely you are working from the first draft of the bill without its amendments. In particular, later amendments narrow "cyber threats" to:

      '(3) CYBER THREAT INFORMATION.—
      ''(A) IN GENERAL.—The term 'cyber
      threat information' means information directly
      pertaining to—
      ''(i) a vulnerability of a system or net-
      work of a government or private entity;
      ''(ii) a threat to the integrity, con-
      fidentiality, or availability of a system or
      network of a government or private entity
      or any information stored on, processed on,
      or transiting such a system or network;
      ''(iii) efforts to degrade, disrupt, or
      destroy a system or network of a govern-
      ment or private entity; or
      ''(iv) efforts to gain unauthorized ac-
      cess to a system or network of a govern-
      ment or private entity, including to gain
      such unauthorized access for the purpose
      of exfiltrating information stored on, proc-
      essed on, or transiting a system or network
      of a government or private entity

I'm not seeing BitTorrent in there.

(By the way, I don't think you deserve the downvotes for bringing this up. I found the amendments aggravating to track down, too. I'd been working from an earlier draft of CISPA that struck "intellectual property", which turned out not to be the one the House voted on.)

</comment></comment></comment></comment></comment><comment><USER6> Listening to this on cspan was...frustrating.

These are people who only learned what the terms "network" and "line of code" mean a few months ago, using them as if they are an authority on the topic.

And to hear some of this nonsense, about China being "an organized crime syndicate", or all the negativity about Russia.

Or about how they're doing all of this because they need to protect citizens from "cyber threats". FFS, guys, no. Look at the complete disaster of security that is the TSA. You're telling us that _you're_ the ones that are going to protect us? Your understanding of what you're talking about is so limited that it took shutting down wikipedia, reddit, and countless other websites for a day to keep you from completely breaking the DNS a couple of months ago.

I think we're doing fine protecting ourselves from "cyber threats", guys, thanks.

[And yes, of course I realize that the "we're doing it for you!" is just nonsense.]

<comment><USER2> I know what a network is and I know what a line of code is.

The underlying concern being addressed here is not invalid.

We are not doing "just fine" protecting ourselves from "cyber threats". In fact, I don't know a single credible person working in software security who believes that. If anything, things in 2012 are far worse than they were in 2001: more critical systems than ever are networked, either directly to the Internet, to open GSM networks, or to proprietary RF. Those that aren't are virtually always one hop away from someone using completely vulnerable clientside software.

Organized hacking syndicates in China are also not a made-up problem.

I probably share your confidence in the Administration's ability to address the problem top-down, but comments like yours actually subtract value from the discussion. Any debate where you lead the opposition to things like CISPA dies immediately, because you've chosen to attack a totally valid premise instead of the specific arguments this bill or Obama's makes.

<comment><USER7> If you actually dig into things hacking has directly caused surprisingly little actual economic harm. The proactive and reactive response tends to be expensive, but in economic terms good old fashion fraud is still way more damaging. As to attacks by nation states, we are actually willing to respond with nukes if things cross a somewhat vague threshold and they are so unprotected as you suggest.

<comment><USER2> Like I said upthread: this was mostly true in 2001, when the power grid wasn't exposed to network attackers.

<comment><USER8> How will this new law fix the problem though? I don't see it.

<comment><USER2> It won't, but that doesn't make the problem bogus.

</comment></comment></comment></comment></comment></comment><comment><USER9> I have no faith in an Obama veto. I feel confident that whatever changes are made to the bill before it passes the senate will be used as an excuse for Obama to sign it.

</comment><comment><USER10> The House passes all kinds of crazy stuff, the Senate is where legislation goes to die.

<comment><USER11> Seriously who gives a shit what the house does? It's basically a filter for the real issues in the Senate.

<comment><USER12> That's exactly how the system was designed to work-- a feature, not a bug, to let hot issues simmer down before passage.

<comment><USER13> Actually no supermajorities were not in the Senate by design.

[http://upload.wikimedia.org/wikipedia/commons/7/79/Cloture_V...](http://upload.wikimedia.org/wikipedia/commons/7/79/Cloture_Voting%2C_United_States_Senate%2C_1947_to_2008.svg)

<comment><USER14> He means that the framers' idea was that the Senate should moderate the House, which is true.

</comment></comment></comment></comment></comment><comment><USER15> So much for the theory that the threat of a veto is as good as a veto.

Anyone willing to bet Obama won't sign this?

<comment><USER16> 168 / 248 = 0.67

Overriding a veto could be quite easy if this gets sent back to the House.

<comment><USER17> That's not how the math works. It's 2/3 * 435 = 290, so they're still 42 votes short.

<comment><USER18> They'd need a 2/3 majority in the Senate as well.

<comment><USER19> The margin they have isn't even enough to get past the 60% cloture vote to pass it in the first place.

<comment><USER20> Hopefully that's where it dies - along with a lot of good legislation in the past -dead waiting for the "silent filibuster" to end.

</comment></comment></comment></comment></comment></comment><comment><USER21> So now how do you get a bill like these repealed, and after how much time? Imagine if SOPA passed like this. I think a lot of people just give up after a bill like this is passed. Plus it's simply much harder to repeal it afterwards - could be a decade or more. Just look at the Patriot Act.

No wonder the politicians wants to pass some bills before Christmas or other vacation. They know once it's passed quickly, the population will do nothing serious about it, and it's _over_.

<comment><USER2> Why exactly would you want to repeal CISPA? Fast forward 1 year, at which time CISPA is in effect, repeal CISPA, and then fast forward again 1 day. How is that day different than the one before it? Be as specific as you can.

<comment><USER22> If government pressures telcom to give it user data, and the telcom gives it data, it becomes open to lawsuits. Thus, telcom might decide it wants a warrant after all.

<comment><USER2> How would it be open to lawsuits? Under what law?

<comment><USER23> How about the ECPA? Does this:

> as may be necessarily incident to the rendition of the service or to the > protection of the rights or property of the provider of that service

allow a telecom to randomly hand private information over to the government? Because it sounds to me like it's not "necessarily incident" unless it's, you know, necessarily incident. Thankfully our court system has the authority to decide that as well.

In the case of CISPA, there are absolutely NO restrictions, and it's been broadened to apply to even more situations than just the provider's security. You are mischaracterizing the current nature of the privacy laws, unless you have something else to add?

<comment><USER2> Yes, it does. What is it that you think "incident to rendition of service" means?

(Not that I think this is dispositive, but I had an actual run-in with an ISP over this clause. They suspected me of hacking their service, because they read my home directory [yes, this is shell server Internet access; I'm old] and found SMTP code in it --- so they recorded copies of all my email messages. A friend worked there and ratted them out. I met with a (good) lawyer. The response: too bad, so sad. GO ECPA!)

<comment><USER23> I assume that it means there is some compelling, /defensive/ purpose of disclosing the information. CISPA is completely indiscriminate and does not carry that same guarantee.

Also your example appears to address what the ISP is allowed to record, not what they are allowed to share, which is a different issue all-together.

<comment><USER2> See:

US v. Harvey

US v. Goldstein

US v. Auler

US v. DeLeeuw

Also, reread CISPA, particularly the amendments clarifying what was meant by "cyber threat" and what activities were exempt from disclosure under CISPA.

<comment><USER23> Thank you.

It appears the EFF disagrees that cyber security threats were meaningfully narrowed in the amendments -- though this does not specifically pertain to any of my previous arguments.

> Unfortunately, this amendment doesn't address the serious problems with the > vague definitions. Even after amendments, "Cybersecurity system" defines the > system that "cybersecurity providers" or self-protected entities use to > monitor and defend against cyber threats. This is a "system" intended to > safeguard "a system or network." The definition could mean anything—a Local > Area Network, a Wide Area Network, a microchip, a website, online service, > or a DVD. It might easily be stretched to be a catch-all term with no > meaning. For example, it is unclear whether DRM on a DVD constitutes a > "cybersecurity system." And such a "cybersecurity system" is defined to > protect a system or network from "efforts to degrade, disrupt or > destroy"—language that is similarly too broad. Degrading a network could be > construed to mean using a privacy-enhancing technology like Tor, or a p2p > protocol, or simply downloading too many files.

Your thoughts?

<comment><USER2> The exclusion which appears _directly beneath_ the language they're commenting on exempts "attacks" that merely violate licenses.

The language they're commenting on also reads clearly: "efforts to degrade, disrupt, or destroy a system or network of a government or private entity". "Efforts" implies intent. BitTorrent doesn't intend to degrade, disrupt, or destroy systems (though if it violates license agreements it _does_ establish a nexus for monitoring under the ECPA!).

Beyond that, look: _obviously_ we can all play the Glass Bead Game to connect _any_ piece of language in _any_ bill back to _any_ action we want to protect. This is why patents are so impossibly annoying to read. But at some point, Occam's Razor has to apply. The language in the amendment we're discussing simply isn't tailored to BitTorrent.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Every US Citizen that reads & participates in Hacker News needs to protest this. This will impact all of you if this goes through & is signed by the President.

America, the home of the free & brave. This is no longer true anymore.

<comment><USER25> citizens in other countries need to find out how to participate too, because as the us goes, so goes many other countries too.

</comment></comment><comment><USER26> Don't forget to thank your Congressperson if they voted NO.

<comment><USER2> How do you know your congressperson doesn't favor some worse intervention than CISPA? Because by HN standards, the Administration's favored course on "cybersecurity" is way worse.

<comment><USER26> Even if a worse intervention is planned (like the one you described above) wouldn't passage of CISPA help to validate it? Probably even make it easier to pass because the Internet's rage has already been depleted?

<comment><USER2> No, that's not how legislation works. When you have two options, one an interventionist Democratic† bill and the other a self-regulating GOP bill, and the GOP bill passes, the Democratic bill does not find a _more_ receptive Congress.

† _< \--- again, note, actual Democrat typing_

<comment><USER27> Your scaremongering about an "interventionist Democratic bill" means exactly nothing until you have such a bill in the same position that CISPA is in today.

Nor is there anything "self-regulating" about expansive internet surveillance .

Let politicians be judged by their votes, not the imagined future plans attributed to them by whoever on no particularly reliable basis...

<http://clerk.house.gov/evs/2012/roll192.xml>

<comment><USER2> It's "self regulating" when it's voluntary and conducted by private companies. How could it not be?

</comment></comment></comment></comment></comment></comment><comment><USER28> What is the deal with the Quayle amendment?

"Would limit government use of shared cyber threat information to only 5 purposes: (1) cybersecurity; (2) investigation and prosecution of cybersecurity crimes; (3) protection of individuals from the danger of death or physical injury; (4) protection of minors from physical or psychological harm; and (5) protection of the national security of the United States."

<comment><USER29> It's an attempt to gain more votes, as opponents could then be painted as having voted against preventing "physical or psychological harm" to minors.

</comment></comment><comment><USER19> Note that this is a 57% margin. If the same holds in the Senate, it won't pass cloture and won't reach the president's desk.

</comment><comment><USER30> If CISPA is passed, we, the citizens of the Internet, need to take broad and quick action to protect ourselves from the affronts of these aging, bloated government bodies.

Tor has proven to be compromised. Almost every forum on the Internet has its handful of sock puppets. What can we do to ensure that our future is free, secure, and anonymous?

</comment><comment><USER31> Without wanting to sidetrack the thread from the real issue of CISPA, I have to take issue with the quality of reporting.

"Many have found the bill to be troublesome, given that, in their estimation, its language was too broad to be safe. Also that the government could use the mandates and powers contained therein in ways that would be antithetical to privacy, and even in the cause of cyber security, could be too intrusive."

In their estimation, powers contained therein, antithetical. What happened to plain language?

"The language of the bill is too broad. It gives the government powers to intrude on the privacy of individuals. Even in the context of security legislation these powers are too intrusive."

</comment><comment><USER32> When SOPA was beaten, I was hoping that our victories against it and each latter mutation of it would outlast the senators voting for it. Should we be worried now?

</comment><comment><USER33> With each passing year, Richard Stallman looks wiser.

</comment><comment><USER34> EVE is coming to real life. Watch out for space pirates out there man.

"2mil ISK OR PODDED"

</comment><comment><USER35> Oh, here we go... not this shit again. FFS.</comment>


Pulling the Plug on GeForce Partner Program - <AUTHOR> https://blogs.nvidia.com/blog/2018/05/04/gpp/ <comment><USER2> It was a huge dick move from the beginning.

Requiring Partners to make their gaming brands Nvidia exclusive way obviously intended to hurt AMD.

Maybe they got a serious call from the FTC about anticompetitive practices.

Also see: [https://www.hardocp.com/article/2018/03/08/geforce_partner_p...](https://www.hardocp.com/article/2018/03/08/geforce_partner_program_impacts_consumer_choice)

</comment><comment><USER3> I find it hypocritical that NVIDIA is trying to spin this as an effort at "clear branding" when they also do things like releasing a lower power version of the MX150 without changing the branding.

[https://www.anandtech.com/show/12565/nvidia-silently- rolls-o...](https://www.anandtech.com/show/12565/nvidia-silently-rolls-out- slower-mx150-for-ultrabooks)

<comment><USER4> also[0].

[0]: [https://www.notebookcheck.net/Nvidia-has-been-sneaking-in- sl...](https://www.notebookcheck.net/Nvidia-has-been-sneaking-in-slower- GeForce-MX150-1D12-variant-onto-some-Ultrabooks.289358.0.html)

</comment></comment><comment><USER5> Good riddance, it was a terrible anticompetitive idea and I would rather see Nvidia innovate instead of relying on such methods.

</comment><comment><USER6> > Rather than battling misinformation, we have decided to cancel the program.

I find that hilarious. Trying to make themselves sound like the victim here.

</comment><comment><USER7> The Register claims that the FTC and the European Commission were looking into it.

"Last month, some of those who had complained claimed in online forums that they had been contacted by regulators, including the Federal Trade Commission (FTC) and European Commission, and had been told the authorities were looking into the reports."

[https://www.theregister.co.uk/2018/05/04/nvidia_gpp_axed/](https://www.theregister.co.uk/2018/05/04/nvidia_gpp_axed/)

</comment><comment><USER8> Does this give any hope that if enough pressure is put on Nvidia that they will cave? If so someone ought to point out to regulators what they have done with that ridiculous 'forbidden in datacenters' clause.

<comment><USER9> Please don't. I like being able to afford GPUs for my gaming PC. If the price equilibrated to be somewhere between current absurdly-underpriced "gaming" GPUs and absurdly-overpriced "datacenter" GPUs, I would not be able to afford them.

</comment></comment><comment><USER10> It isn't clear to me from this press release what "leaning into GeForce" means. Will partners need to include the GeForce name as part of their product names, in addition to the product numbers?

Anyway, I'm a little surprised that Nvidia didn't ride out the complaints and press their current GPU advantage, but I assume they're working with a more complete picture of the landscape than I am.

<comment><USER11> Oh, they absolutely didn't do this just due to PR reasons. This barely even showed up on the radar even for people who follow gaming technology, let alone the bigger market. Seems pretty obvious they realized they'd totally miscalculated things and this was going to be a legal nightmare for them in the EU. And you don't ride out the complaints anti-competition regulators.

</comment></comment><comment><USER12> Are they _actually_ pulling it? Maybe they're just trying to avoid negative publicity.

If they are pulling it, I wonder why. I suppose it probably meant all their AIB partners hated them.

<comment><USER13> They're pulling it because it already did its damage. That and to make GPP2.0 w/ nda/gag orders built in.

</comment></comment><comment><USER14> Has anyone heard of "substitute [presumably AMD] GPUs hidden behind a pile of techno-jargon"?

<comment><USER15> that did make me laugh.

user: i would like to order ummmmmm....a GPU seller: we got this high performance gaming GPU that is compatible with direct X, uses DDR5 8gig memory and base clocked at 1600 MHz, memory speed is 10gbps, supports open gl has high bandwidth memory. we call it {asus/msi/...} GPX10000000x user: i just want the one with Nvidia Pascal. thx. ;)

</comment></comment><comment><USER16> I don't understand anything at all from this press release.

Could somebody TL;DR the situation to someone who doesn't follow GPU markets?

<comment><USER17> The best summary is an example. Prior to the GPP muscling, ASUS sold both nVidia and AMD cards under its ASUS brand, using sub-brands like ROG, nonsense branding terms like Strix, etc. But they were all ASUS on the box.

After capitulating to the GPP requirements from nVidia, all of ASUS's AMD card offerings are rebranded under the name AREZ. The boxes hide the ASUS branding in dim gray, off in the corner, where you won't notice it at all. It looks like an entirely different company and makes it look to a casual observer like ASUS (a famous brand like it or not) doesn't even sell AMD cards. Only nVidia. And of course, AREZ is just some new no-name brand who can even trust it? And all they sell is AMD, probably some budget garbage right?

It's stupid. nVidia makes it sound like they were innocently trying to promote their products when they were actually forcing well known brands to entirely divorce their trusted names from AMD products. No matter what way nVidia tries to spin this, the outcome was anticompetitive in every way.

<comment><USER18> >After capitulating to the GPP requirements from nVidia, all of ASUS's AMD card offerings are rebranded under the name AREZ.

source that one caused the other?

<comment><USER19> By sheer coincidence, within hours of the announcement of GPP ending they have ROG-branded AMD cards back on their website and AREZ has disappeared.

</comment></comment></comment></comment><comment><USER20> Anyone who thinks Nvidia was being anti-competitive here is delusional. There is no competition in the GPU market simply because there are no competitors. Nvidia GPUs are so far beyond AMD in terms of performance that they are qualitatively different products, which serve entirely different markets. The market could be called a duopoloy at best, but any notion of free market competition is absurd when you factor the sunk cost of trying to catch up with Nvidia.

We're not talking about commodity widget makers vying for market share here. This is a company at the absolute forefront of computer science and engineering, pushing the boundaries of what is possible for humanity.

<comment><USER21> > pushing the boundaries of what is possible for humanity.

Oh please.

There's a _ton_ of competition in the GPU space, heck Nvidia isn't even in one of the more popular modern consoles. There's other GPU markets as well where Nvidia is far from the dominant player.

<comment><USER20> Who? Who else is selling top end consumer GPUs?

<comment><USER21> > no competition in the GPU market

There will be no goalpost moving here.

AMD, ARM, Qualcomm and PowerVR all build compelling GPU solutions.

<comment><USER20> Ok, so go build a gaming rig with an ARM GPU

My point from the very beginning is that there is only one viable option for a top end consumer GPU, as would be desired by the gaming community.</comment></comment></comment></comment></comment>


Are You The Best Developer In The World? - <AUTHOR> http://www.skorks.com/2009/08/are-you-the-best-developer-in-the-world/ <comment><USER2> Pardon the copy editing, but let's not make up words when the exact word you want already exists. The word is "humility", not "humbleness".

<comment><USER3> And please don't correct someone for using a word that is a real word, nonetheless an unpopular one:

      http://www.answers.com/humbleness

This reminds me of when I was told the word "priorly" was made up.

<comment><AUTHOR> Thanks for that, I've been copping flac left right and center even on twitter :)

</comment></comment></comment><comment><USER4> I aspire to being neither humble nor arrogant perception of myself; I aspire to having an accurate perception of my self worth in every area.

<comment><AUTHOR> Exactly the point I was trying to make

<comment><USER5> I read a quote somewhere by Golda Meir, it went 'don't be humble, you're not that great'.

There is a lot of meaning in there, for one, to be truly humble you first have to ascend to greatness.

So for the majority of us ordinary mortals it's fine to be proud of our achievements. But to descend into arrogance is one step too far.

</comment></comment></comment><comment><USER5> Emphatically: NO. I'm definitely not the best developer in the world, I've met 18 year old kids that could literally run rings around me.

But being 'best' in anything is not the criterium. Only one person can be 'best' at anything. But to put the whole workload of the world on the shoulders of that 'best' person is not feasible. So everybody contributes to their ability. And we try to learn as much as we can from the best.

<comment><AUTHOR> Agreed, but also we not only try to learn from the best, but also try to teach what we know to those who know less.

<comment><USER5> That's very true, consider that a beta release bug ;)

So how about: "And we try to learn as much as we can from the best and from each other." ?

<comment><AUTHOR> That's what I meant, (I guess I didn't express myself very well)

</comment></comment></comment></comment><comment><USER6> It's rare in my experience that anyone believes they really are the best developer ever. Generally programmers seem to be a pretty humble bunch, I think. Perhaps because the nature of our work is such that, in a sense, bugs are there because of our own personal failings and mistakes. We deal with that all day, every day. How could anyone, when faced with such an ever-present reminder of their own deficiencies, honestly think of themselves as the best?

(Although in thinking about this, perhaps maintenance programmers are most prone to this as their task is largely to fix bugs in other people's code - not their own. It'd be easier to fall into that trap, I imagine.)

I suspect that most "I'm the best ever" talk is just a game. A form of "blowing off steam." All the developers I know do that at least some of the time. Everyone knows better, though. It's all tongue in cheek stuff and just for fun. Often it ends after a few rounds of ludicrous build up to the point where the entire universe itself would have imploded if it wasn't for me... :)

</comment><comment><USER7> _Are You The Best Developer In The World?_

I don't have to be.

But I do have to be the best developer on what I'm working on. That's what I strive for. I want to be proud of everything I do.

</comment><comment><USER8> Like this guy? [http://girlvinyl.com/lj2009/Recent_Graduate_Programmer_Neede...](http://girlvinyl.com/lj2009/Recent_Graduate_Programmer_Needed_- _C%23%2C_ASP.NET%2C_SQL_1248638229344-20090726-155736.jpg)

</comment><comment><USER9> I've run into a number of writers whose stated goal was to write better than anyone who wrote faster. Using that definition, they could all be "best".

What definition of "best" are we using?

</comment><comment><USER6> Oh hell yes! To put it another way: Have you heard of Plato, Aristotle, Socrates? Morons.

(cough...)

<comment><USER6> Wow. Is "The Princess Bride" humor not allowed here or something? :P

<comment><AUTHOR> Oh yeah, now I get the reference :)

</comment></comment></comment><comment><USER10> Your greatest strength is knowing your weaknesses.

</comment><comment><USER11> My favorite Slashdot comment on this subject matter was:

"Every developer wants to think of themselves like House, M.D. where if they left the company it would fall apart. In reality, everyone is replaceable and if you got hit by a bus today in three months the company will have completely recovered."</comment>


Nine auto makers partner with Apple for 'Eyes Free' Siri support - <AUTHOR> http://www.appleinsider.com/articles/12/06/12/nine_auto_makers_partner_with_apple_for_eyes_free_siri_support.html <comment><USER2> Of course, this is just an intermediate-term situation. By 2020, available self-drive cars will allow the human passengers to devote all their attention wherever they want.</comment>


TeamViewer users are being hacked in bulk, and we still don't know how - <AUTHOR> http://arstechnica.com/security/2016/06/teamviewer-users-are-being-hacked-in-bulk-and-we-still-dont-know-how/ <comment><AUTHOR> TeamViewer has officially blamed password reuse as the culprit. But several postings on reddit in r/teamviewer indicate that users had long random alphanumeric passwords generated by password managers unique to TeamViewer and were still hacked. The hacks are often to the tune of hundreds of dollars via PayPal with the logged-in bots scripting a quick transaction from another source and then it being automatically paid via Chrome controlled via a TeamViewer session. PayPal has been reversing about 1/2 of the transactions as unauthorized when users report them but refusing to reverse about 1/2 of them.</comment>


Ask NYYC: Help us make a gathering plan. - <AUTHOR>

We're planning to meet! We don't have a date or location yet, but that's on purpose. Please vote for the date and location (submit them together) that you think works best.<p>If you have any questions feel free to email me at jdennis at gmail. <comment><USER2> I think the Radegast Beiergarten in Williamsburg (<http://nymag.com/listings/bar/radegast-hall/>) would be a great place to meet (long tables, beer steins, sausages) and it's very accessible for people of all boroughs (first stop in Brooklyn on the L-Bedford Ave). It tends to get crowded on Weekend nights but should be comfortable on a Sunday evening.

Full Disclosure: I live in Williamsburg. That said, I'm more than open to any other location in Manhattan or Brooklyn.

<comment><AUTHOR> I like this idea. How about Sunday July 20th starting around 7:30pm?

<comment><USER3> A simple proposal: if 7 people post here agreeing to show up at the aforementioned time/place, it's on.

Counting me and j2d2, we've got 2 so far.

<comment><USER4> 3

<comment><USER5> 4

<comment><USER6> 5

ps. fortes, you're coming in from Seattle?

<comment><USER2> 6

<comment><USER7> 7

<comment><USER8> 8

<comment><USER9> 9

<comment><USER10> 10

<comment><USER11> 11

<comment><USER12> Sadly, I'll be gone that weekend.

<comment><USER13> Me too. Please post the next one though.

<comment><USER6> How about we make it the last sunday of the month? This will be easy to follow and people can plan accordingly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> How about Sunday July 20th, 6pm?

As I live/work in Manhattan, I would prefer if it's reachable by subway since I don't have a car. < <http://www.mta.info/nyct/maps/submap.htm> >.

<comment><USER14> Unfortunately, I'll be out of town that weekend. However, I don't want to interfere with the group's plans.

What about the weekend after (July 26/27) or the first weekend in August (August 2/3)?

<comment><USER15> First weekend of August is great for me.

</comment></comment></comment><comment><AUTHOR> I live and work in Manhattan and am happy to travel to any of the five boroughs, though I prefer Manhattan and Brooklyn.

<comment><USER16> Work in Union Sqaure, live in Gramercy. Prefer Manhattan meeting locations.

</comment></comment><comment><USER17> I live in Brooklyn myself, but Williamsburg isn't terrible convenient. It's equally inconvenient for people coming from UES/UWS and NJ. It would be best if we picked something equally accessible to everyone - in my experience Union Square West Village are usually good middle grounds.

That said, I'm definitely interested. Don't think I'd be able to do it on 7/20, but we should make it a regular thing (and even rotate location). Can we make a Google Group for this or something?

<comment><USER2> That's a good point. I went ahead and created a Google Group in the event that this becomes a regular thing (<http://groups.google.com/group/nyyc>). From here on out I suggest we use the Google forum to suggest locations, dates, etc.

</comment></comment><comment><USER18> Live in Brooklyn, work in Brooklyn. I'm happy to travel to Manhattan. The title of this post isn't immediately clear, I'd hate to miss out on meeting fellow NYC hackers

</comment><comment><USER19> I'll try to attend, as will my co-founder. As somebody else mentioned, a 21+ venue might prevent some people from participating. Manhattan is preferred, although Brooklyn is no big deal.

<comment><USER20> Looks like I've already been RSVP'd, then. See you there!

</comment></comment><comment><USER21> I'm thinking about taking the Bolt Bus over from Boston. I know Radegast well, I actually used to date a waitress there.

</comment><comment><USER2> NYYC Google Group: <http://groups.google.com/group/nyyc>

<comment><USER14> Joined.

<comment><USER6> Joined.

</comment></comment></comment><comment><USER5> I live in Manhattan (Chelsea). I vote Manhattan, but I'm down for Brooklyn if it's got easy train access.

</comment><comment><USER22> Anywhere in Manhattan or Brooklyn would be nice. Preferably closer to a subway station.

</comment><comment><USER13> I vote for near a subway stop as well. Weeknights or Sundays work best.

</comment><comment><USER23> Sounds great. I'd love to join. Can you update this by week's end when you've completely settled on a time/location?

</comment><comment><USER24> Are non-coders welcome or would I be strung up at the door? :)

<comment><USER14> I hope I don't get left out!

Judging by HN folk, I believe all are welcome.</comment></comment>


The Collective Body: Russian experiments in life after death - <AUTHOR> https://www.thenation.com/article/culture/anya-bernstein-future-immortality-russia-cryogenics-review/ <comment><USER2> The idea of individual immortality seems at odds with how the universe works. But the idea that consciousness is an emergent property of matter and energy is appealing, because it opens the door to the idea that we are all facets of the same thing.

What is 'we' to us (and whatever other life is out in space) could be 'me' to the universe, and some philosophers like Spinoza have explored the idea of a "God" which is more or less defined as the empirical laws of this universe.

And sure, eventually this universe will also die. But that's okay, because it is also probably part of some larger entity which will also eventually end, and so on. That's how I choose to interpret the infinite, and it brings me comfort because it lets me see death as a change in perspective rather than a finality. It also helps me practice empathy, by not seeing much difference between what I feel and what others feel.

The idea of collective transcendence is also interesting. One work which explored it was Alpha Centauri, a Civilization-style game where the players' colonies crash-land on a planet which eventually turns out to be sentient thanks to global networks of fungus which act as neurons. If the player is eco-friendly, they can eventually communicate with the planet and dump their citizens' consciousness into the seemingly-immortal planet. Even that would only delay the inevitable, but to quote the game's CEO Nwabudike Morgan:

>I plan to live forever, of course, but barring that I'd settle for a couple thousand years. Even five hundred would be pretty nice.

Sound familiar, Thiel?

<comment><USER3> > it opens the door to the idea that we are all facets of the same thing.

> What is 'we' to us (and whatever other life is out in space) could be 'me' > to the universe

> That's how I choose to interpret the infinite, and it brings me comfort > because it lets me see death as a change in perspective rather than a > finality. It also helps me practice empathy, by not seeing much difference > between what I feel and what others feel.

I'm 100% with you on this. I've largely gotten there through introspection and "logical" thinking, but I'd love some more formal structure (or for some definition of formal). Any suggestions on other philosophers to read on this subject?

I think a lot of the desire for immortality comes from the understandable (and totally human) fear of the unknown / death. But if you change your perspective - that "me" is only "me" relative to, well, me -- and that if you go up a level in abstraction (look at all of humanity or, really, all of consciousness), you realize that any one "me" doesn't really matter all that much -- and that someone else experiencing consciousness is just as valid and relevant as your own experience of consciousness -- and that from that slightly higher level perspective, there's a LOT of consciousness happening, and it's all valid and relevant and interesting (and will continue for a LONG time!)

Just because your one perspective may disappear in N years doesn't mean there isn't a lot of other experience that will still be happening, and that, to your point, death is only a change in perspective.

<comment><USER4> The Logos, according to jewish-hellenistic philosophy, was the eternal emanation of the One. Philo of Alexandria (b. 50BC) allegorically referred to the Logos as the son of God. Christianity claims to provide eternal life, simply through belief in the "Logos" (incarnated in Jesus).

So if one views oneself not as a separate person but as part of this eternal emanation, then by definition you do live forever.

</comment></comment></comment><comment><USER5> This will sound odd to the vast majority but there are some who view the whole idea of their personal immortality as awful and the drive to obtain it incomprehensible. Even if it were in some harp filled cloud borne paradise let alone in the real word. To some, permanent existence seems unspeakably nightmarish.

<comment><USER6> I don't think most people advocating for, say, curing death through aging are advocating forced immortality. It's just a few years more- it's just not dying tomorrow, or next year, or next decade.

Yes, if you imagine an arbitrary boundless personal future, there are a lot more ways it could end up being on average a negative experience than a positive one. I've never heard anyone argue against having an exit plan for that eventuality (i.e., I've never seen anyone argue a 500-year old should be prevented from killing themselves).

I don't think you would turn down a magic pill that would extend your lifespan-with-a-21-year-old's-vitality tomorrow, would you?

I think all the 'immortalists' want is for everyone to live as long as they choose to, and not have the choice taken away from people as it is now.

</comment></comment><comment><USER7> Fascinating review. But, honestly, I really wish these ideas were treated as derivative of the religious-cultural matrix they came from. Why is transcendence given such a high priority? Speculatively - I am not an expert - it is due to the regional influence of the "East" Orthodox church and the underlying notions of theosis and transcendent mysticism that threads it in ways that were less common for the West.

Ideas, particularly recurring and popular ones, do not arise _de novo_, but have an interlinking with a population susceptible to them.

Personally, while I believe (religiously) in an afterlife, I don't desire immortality. Long & healthy life would be nice; but my time in this universe has an end, and _that's ok_. Let my child be an adult free of my control.

</comment><comment><USER8> Immortality == the end of childhood.

Yes, I'm referencing the title of the novel, Childhood's End. But it's true. If we lived 1,000 years, we couldn't have two children per-woman every 40 years -- we could only have two children per-woman every 1,000 years. That would yield a minuscule number of children at any time. A life expectancy of 1,000 years would require finding a way to extend fertility from ~35 years, otherwise many opportunities to reproduce would be missed completely and fertility would drop well below replacement rate, furthering the end of childhood.

No, we can have immortality, or we can have children, but not both.

I can't imagine a life without children. So I choose mortality. I want to die (in time) so that my children may have children. And my children too will have to die (in time). It's just how it has to be.

But we can talk about what would be a good life expectancy. 200 years would be fine, provided the first 160 of them one could have a young body and mind. And provided we can find a way to not get too bored :) Even 1,000 would be fine provided our bodies and minds stayed young for 850+ of those 1,000. In any case, I don't want to live 120 of 200 years in an old people's home.. Who would?!

<comment><USER9> If you haven't experienced 17776 yet, please do!

[https://en.wikipedia.org/wiki/17776](https://en.wikipedia.org/wiki/17776)

[https://www.sbnation.com/a/17776-football](https://www.sbnation.com/a/17776-football)

<comment><USER10> Wow. That was beautiful. I just spent the last couple hours reading through it. Being stuck in my house looking at the world through a screen, I can empathize with that little trashcan hurtling through space. Thanks for sharing.

</comment></comment></comment><comment><USER11> More than a few intrusive overlays covering an article largely about politics, a paragraph about NeuroNet, followed by talk of climate change.

I seem to have skimmed past the part about life after death?

</comment><comment><USER12> "Life after death" sounds like an oxymoron to me (unless we are talking about revival, of course).

</comment><comment><USER13> First they need to revoke mathematics, that less probable states will transition to more probable states.

<comment><USER14> Life would not emerge at all if this statement would be that simple.

<comment><USER15> There is a hypothesis that life emerged because living things dissipate energy more efficiently[0]. As one possible implication, individual immortality given humanity as we know it might appear counter to that goal. As a more far- fetched implication, evolving humanity in a way that motivates accelerating efficiency of energy capture and dissipation _even as individual longevity increases_ could theoretically unexpectedly inch us closer to immortality.

[0] [https://www.quantamagazine.org/a-new-thermodynamics- theory-o...](https://www.quantamagazine.org/a-new-thermodynamics-theory-of- the-origin-of-life-20140122/)</comment></comment></comment>


Covid-19 emails from Nashville mayor's office show disturbing revelation - just-juan-post https://fox17.com/news/local/covid-19-emails-from-nashville-mayors-office-show-disturbing-revelation <comment> just-juan-post In Nashville, TN (USA) bars and restaurants are closed to stop the spread of the virus. In e-mails obtained by a local television station, and later confirmed authentic by legal council, the e-mails discussed how only 80 of the 20,000 positive cases could be traced to bars and restaurants.

> Tennessee Lookout reporter Nate Rau asks, "The figure you gave of 'more than > 80' does lead to a natural question: If there have been over 20,000 positive > cases of COVID-19 in Davidson and only 80 or so are traced to restaurants > and bars, doesn't that mean restaurants and bars aren't a very big problem?"

The above story broke yesterday.

Today they have allowed bars and restaurants to re-open:

[https://www.tennessean.com/story/money/2020/09/17/nashville-...](https://www.tennessean.com/story/money/2020/09/17/nashville- bars-restaurants-covid-19-gains/3479447001/)

I encourage others in parts of the USA such as NYC and LA to question their officials and ask them directly why they continue to keep bars, restaurants, gyms, and other small and mid-sized gatherings forbidden.

<comment><AUTHOR> I support data based evidence. But it seems self-evident that a virus that spreads by air and particularly one with some ability to persist is going to love people in close proximity in an enclosed space and it's not like you can consistently be well masked and eat. I have to think that the virus would also love the warm moist environment of fresh food.

Further, it is very difficult to take an infection case and trace back to when and where it occurred. I don't think we can take bare statistics on this at face value.</comment></comment>


ARM Cortex-A57 Software Optimisation Guide [pdf] - <AUTHOR> http://infocenter.arm.com/help/topic/com.arm.doc.uan0015a/cortex_a57_software_optimisation_guide_external.pdf <comment><USER2> From page 6,

>> Instructions are first fetched, then decoded into internal micro-operations

Is 'micro-operation' the same as microcode? I'm not familiar with the ARM Cortex-A architecture but I always thought ARM didn't have microcodes?

<comment><USER3> ARM does have microcode (though early ones didn't).

Basically if you don't have microcode, you kinda tie your instruction set to your physical architecture, which makes it hard to progress.

For example, at the time of the Pentium 3, all instructions were 64 bit - execution units, buses, register renaming tech. SSE had 128 bit vector instructions, which would screw with this. For this reason, Intel split them into 2 64 bit micro-instructions.

ARM generally doesn't have _patchable_ microcode, which might be the source of your confusion?

<comment><USER4> You are confusing the concept of uops (or micro-instructions) with microcode.

Microcode is when the CPU runs microcode from a microcode ROM to implement an instruction. In CISC days this was often all instructions (these were termed microcoded CPUs). The same architecture might have cheap microcoded and high end "hardwired" implementations.

There's a conceptual similarity between uops and microcode, to quote the WP microcode article: "Modern CISC/RISC implementations, e.g. x86 designs, decode instructions into dynamically buffered micro-operations with instruction encodings similar to traditional fixed microcode. Ordinary static microcode is used as hardware assistance for complex multistep operations such as auto- repeating instructions and for transcendental functions in the floating point unit; it is also used for special purpose instructions (such as CPUID) and internal control and configuration purposes."

</comment></comment></comment><comment><USER5> Similar table for x86 instructions:

[https://gmplib.org/~tege/x86-timing.pdf](https://gmplib.org/~tege/x86-timing.pdf)</comment>


Ask HN: What knowledge do I need to get real time system/low latency related job? - <AUTHOR> I am currently a full stack developer (javascript angular + node ) 2 years out of college, I realize recently that full stack doesn't really interest me that much and I want to transition to a job that deal with low latency and RTS like real time bidding etc.
I have begin to learn Rust, golang and practice implementing a bunch low latency and distributed related algorithms (hyperloglog, maglev hashing, raft), I also try to contribute to some open source related to distributed programming and got some merged to master. But most of the place that is willing to interview me are offering full stack. I think I might be lacking some skills that company dealing with RTS are looking for.
My next step is to implement my own rts system like scrape message from reddit or something and do some interesting analysis using kafka for my topology not sure if thats a good idea. Big data/distributed program/low latency stuff is really hard to practice in my own time (ie. server cost).
Can someone point me some direction? Like what knowledge/experience do I need, what are those companies looking for?
Note: I am from SF <comment><USER2> Rts is different (airplanes,missiles etc). How about finding jobs in stackoverflow, see their requirements and do them ? Example: [http://www.scylladb.com/career-post/software- developer/](http://www.scylladb.com/career-post/software-developer/)

</comment><comment><USER3> When I think real-time I think embedded programming. In particular, formal methods and scheduling. This is an understood canon of work, so there are lots of good textbooks, courses, etc in the area.

When I think latency I think really fast. The nice thing about that domain is that each piece is quite important. Even just getting the data from Reddit in a timely/efficient/optimized manner is an interesting puzzle in its own right. Personally, I'd focus on those components, work out what makes them really fly, write some interesting stuff.

</comment><comment><USER4> Erlang, QnX, RTOS would be good starting points.

Note the differences between 'soft real time' and 'hard real time'.

Embedded controllers are another fruitful avenue of research, as are systems that are hybrids, for instance very tight control loops in FPGA driven by conventional processors.</comment>


Researcher shows how to "friend" anyone on Facebook within 24 hours - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/11/researcher-shows-how-to-friend-anyone-on-facebook-within-24-hours.ars <comment><USER3> There seems to a lot of confusion, both in the article and in the comments, about the "3 trusted friends" password recovery. You have to manually select your trusted friends [1]. A fake account mimicking one of your friends will not be a "trusted friend" unless you make him or her one.

Furthermore, this is an opt-in feature.

[1] <https://www.facebook.com/help/?faq=119897751441086>

<comment><USER4> You need to trick an account into accepting three fake friends, since those users will receive the code to change the password. Hardly seems like obvious security flaw, more like a long, complicated piece of social engineering. Which is what all hackers do....

<http://www.hackersonlineclub.com/hack-facebook-account>

<comment><USER3> You need to trick an account into adding three fake friends as "trusted friends", a feature that most people do not know about or use. This is much harder getting someone to friend three fake accounts.

</comment></comment></comment><comment><USER5> I was surprised to learn that Facebook has a "3 trusted friends" method for recovering your account without the original email or security question response.

EDIT: tried to find a better source for that, came up with [https://www.facebook.com/notes/facebook-security/national- cy...](https://www.facebook.com/notes/facebook-security/national- cybersecurity-awareness-month-updates/10150335022240766)

Looks like the feature is still being rolled out, and the attacker doesn't get to choose which friends he trusts.

<comment><USER6> Right. Does this mean that me and two of my friends can just decide to stage a coup on any of our mutual friends' accounts?

EDIT: Yeah, apparently it does. _Sweet._ Time to scour /b/ for some truly horrible shit to plaster peoples' profiles with. Also highly recommended: changing their birthday to tomorrow.

<comment> X-Istence Don't I have to set up these three trusted friends? All I can find in Facebooks documentation is that I would need to specify these three to five trusted friends but I can't find anywhere to set this up.

<comment><USER7> Hm, this link has different screenshots: <http://www.hackersonlineclub.com/hack-facebook-account> _Any_ 3 "friends" who put their codes in can get access to your account.

</comment></comment></comment></comment><comment><USER8> The first thing I did when I saw this story was check Google to see if any other news sources had picked it up. I chose the researcher's name as a highly distinctive Google search term. I didn't find any source but Ars Technica just now that reports this finding. I noticed that there are websites that appear to belong to the Brazilian researcher, but I guess the moral of this story is that those websites may all be fake [sigh].

<comment><USER9> Ars has not been a good website for some time now, at least a couple of years. They have squandered their future, but I dunno, I haven't checked but were they acquired by Gawker at some point? It would explain a lot.

<comment><USER10> Conde nast... not gawker.

[http://arstechnica.com/old/content/2008/05/ars-technica- acqu...](http://arstechnica.com/old/content/2008/05/ars-technica-acquired-by- conde-nast-the-low-down.ars)

<comment><USER9> Dare I say worse? ;)

</comment></comment></comment></comment><comment><USER11> I deleted my Facebook account about 3 months ago

Security was one of the big issues for me. My brothers account had been hacked, and the hackers managed to get some cash out of some of his friends.

But I digress, and this off topic, but I don't miss FB at all. I still maintain genuine relationships outside of FB and find I have more time for proper conversations with people via Skype and email. FB to me was crack, I hated to love it. Now I love to hate it.

Does anybody out their maintain genuine relationships through FB? (Serious Question) Why are we using it? Is it an addiction?

<comment><USER12> I've deleted my Facebook a number of times. I know this sounds petty, but the main reason I always signed back up was because my girlfriend at the time wanted to be in a relationship with a 'real person' not just a name on Facebook. This was two different, perfectly well adjusted women.

I think this speaks to Facebook as a status symbol not as a communication tool. Why do you upload pictures of your vacation? Because you want grandma to see them and enjoy seeing your lovely face or is it to impress all your friends with this awesome life you have. I think it is mostly the latter.

<comment><USER13> I'm a tad short of sleep, so forgive me for asking what is probably a really stupid question but I'm confused: Are you saying these two different women wanted you to flesh out some online profile via FB (as proof of a real relationship or something like that)?

<comment><USER12> On Facebook you have a section called relationship. In that section you can put a name. If that person doesn't have a Facebook profile, I assume, it doesn't hyper link it to their profile. If that person does have a Facebook profile then it hyperlinks to their profile page.

Clearly, the relationship isn't going to depend on if I have a Facebook profile, but both women want their friends to be able to see that they have a 'real boyfriend' with real interests, pictures, etc. In effect they want to show off for their friends.

<comment><USER13> _In effect they want to show off for their friends._

And perhaps also position themselves defensively with regards to other men. It seems to me that listing a name with no hyperlink is something you could do to "fake" having a boyfriend, and thus might not be a very effective deterrent to unwanted attentions from another man. An actual FB account linked in that section is much stronger proof that a woman is unavailable, so please don't bother me.

It seems to me that if you have some significant portion of your social life online, indicators of that sort can be rather important. I know that when I was still married and could publicly portray myself as a "woman who has been married with children for a very long time" I did not have to deal with certain kinds of things in online social settings. I joined one forum after it was clear to me and my spouse that we would divorce but at a time when our status was still publicly presented as "married, with children". When I was at a point where I was ready to publicly admit I was facing a divorce, I suddenly had online social situations to deal with that simply did not crop up when everyone figured I was about as off limits as a woman could get. So my personal situation had not really changed (as I was still "facing a divorce" and not really available) but there were very noticeable social consequences when how I presented my social status changed.

I'm not on Facebook. I deleted my account earlier this year and never used it that much and I think everyone I knew on Facebook was probably either female or only interested in me due to my medical diagnosis. So I never dealt with that aspect of Facebook. But I know that I do deal with the need to signal my "currently unavailable" status in other online social settings. It's simply far easier and more effective to just make it generally publicly known that I am not currently available than to try to deal individually with every potential inquiry.

So my guess would be they are not simply showing you off to their friends. It probably serves a broader purpose similar to an engagement ring or other offline relationship status signal, and that means it may also have implications for things like what types of social invitations that single women friends might extend to them (ie "I'm no longer available for girls night out, where we go out drinking/partying" or something). Whether there is a hyperlink vs just a name listed may have hard to quantify but real impact on how others interact with them.

<comment><USER12> You are correct. I actually typed something similar up, but after reading it it came across too much like, "I don't trust her."

</comment></comment></comment></comment></comment></comment><comment><USER14> Kind of a stretch, an elaborate ploy all to merely "friend" someone.

Like, "Car thieves who want to steal your car can construct an exact replica of your street, house, and garage, so that you're actually parking right in the thief's carpark, security researchers reported today."

<comment><USER15> It sounds like you're equating basic social engineering to an elaborate, large-scale, nearly impossible architectural trick. Are you trying to discount the effectiveness or feasibility of social engineering? Social engineering requires far less effort that your proposed analogy. I doubt if it took this guy more than half an hour to do the "hard work," which is just duplicating a profile and cross-referencing friends from two social networks.

I agree that accidentally friending a fake account probably won't lead to much further online problems: the trusted friends example used in the article is far-fetched (and other HN comments indicate it's complete bogus), and they're not going to get your credit card info or account passwords. However, it's still a privacy concern. Anyone from an estranged ex-lover to a private investigator could get information like home address, vacation times, etc.

<comment><USER16> _However, it's still a privacy concern. Anyone from an estranged ex-lover to a private investigator could get information like home address, vacation times, etc._

Only if you put information on Facebook that you're not comfortable sharing with the whole world.

<comment><USER15> I'm not sure what you mean by that statement. Are you saying that Facebook's internal security is weak, and therefore you shouldn't trust it with data that you _explicitly_ make private? To my knowledge, Facebook's privacy concerns are more related to the tracking of users on other websites, having insensible privacy defaults, and having confusing privacy controls. I've never heard any concerns about Facebook ignoring your settings and leaking your content (that was just meant for your friends or a certain group) with the whole world.

Are you singling out Facebook, or just referring to web services in general? Would you also say that you shouldn't have data on Gmail that you're not comfortable sharing with the whole world? What about online banking? All of those things are probably vulnerable to social engineering.

<comment><USER16> _I've never heard any concerns about Facebook ignoring your settings and leaking your content (that was just meant for your friends or a certain group) with the whole world._

That's the end-result of "having insensible privacy defaults, and having confusing privacy controls." It happened when they changed their privacy model, and things that were private-only became public by default. But, normally, it's not that Facebook _ignores_ your settings, but, rather, people assumed things were more private than they actually are. See people's recent reaction to the real-time updates of what your friends are doing on Facebook - many of the people I am friends with where aghast at this, because I don't think they realized all of that stuff was already public.

Basically, I think the privacy-model on Facebook is complicated, but I think it's an _inherent_ complexity. It's not complex because Facebook is inept, it's complex because the problem of determining who in your large social network should know what is actually a complicated question. That privacy model is too complicated for people to grapple with every time they share something on Facebook, so they don't grapple with it. I don't want to grapple with it, either. Hence, I only share things on Facebook I'm comfortable sharing with the world. My Facebook page - wall, photos, info, comments - <USER2> all public. Then I have a very simple decision to make: am I okay saying this to everyone? If not, I don't say it. Hence, I don't say much on Facebook.

The internet is an inherently public place. Facebook puts a megaphone on the internet.

 _Would you also say that you shouldn't have data on Gmail that you're not comfortable sharing with the whole world?_

In general, yes, although even I have difficulty with that one. But email is just plain text (unless you encrypt it, and very few people do) bouncing around the ether. It's out there, and you have little control over it. Banking is different, as the information is only shared between you and your bank. Not so with email, which always has at least one other party involved.

</comment></comment></comment></comment></comment><comment><USER6> I miss the good old days when I could only send friend requests, not receive them. I guess clicking ignore every time isn't so hard. It was better back when people simply could find the "Add Friend" button though, there wasn't any risk of them being offended.

<comment><USER9> Facebook friendships have always been symmetrical.

<comment><USER9> Votes seem to be fluctuating on this, so I'm just going to add qualifications of "possibly not when it was University-only (i.e. before my time)" or "until recently" as they've moved to subscription connections and wall propagation for unconfirmed friendships.

</comment></comment></comment><comment><USER17> I would be wary of anyone calling him/herself a "web security expert" who tolerates a presence on multiple social networking sites. It speaks of a mindset not nearly paranoid enough.

</comment><comment><USER18> A little melodramatic. My father logs into Facebook about once a month. How can you guarantee that he'll friend you within 24 hours?

<comment><USER19> You can't, really, but if he checks his email more often than once a month, he may act on the message that says "xxx has added you as a friend, please confirm."

</comment></comment><comment><USER20> "Privacy is a matter of social responsibility."

Privacy is a matter of not using Facebook.

<comment><USER21> No. Privacy is what you make it to be. If you don't want someone to know you like to rub lettuce over your face, don't tell anyone.

The same principal works for real life too.

<comment><USER20> What if someone wants to tell a few friends about something but doesn't want to tell all the people working at Facebook, all its clients and potentially any other Facebook user?

<comment><USER16> Then don't tell them through Facebook.

If you don't mind Facebook knowing what you said, you can send a private message.

That may not be a solution that people _like_ , but it's what I do, and I think it's what we will all end up doing eventually.

<comment><USER20> "Then don't tell them through Facebook."

And that's the point.

If a current offering such as Facebook is "not a solution that people like", then that creates an opportunity for a solution that people _do_ like.

Will that opportunity be exploited? If not, why?

<comment><USER16> I don't think any large, online social network used by lay-people can allow the kind of privacy control that you (and many others) want. The system just becomes too complex, and information leaks. I think that we will eventually adapt to this constraint.

<comment><USER20> You said: "I don't think any large..."

If someone only wants to tell something to some of their friends, and assuming "some" is not a large number, does the network have to be "large"?

If so, why?

<comment><USER16> For lay-people to know about and be comfortable using it, yes, I think it has to be a part of a large service.

There are ways to share secrets with a small number of friends online, but even among technical people, very few people do it. I can see that it's possible to create a service around, say, PGP encrypted messages, and I can even see abstracting out the technical details of it. (That is, not forcing the users to think about keys, instead saying "Tell us who you want to be allowed to know the secret" and making and distributing public-private keys on the fly.) But I think even that level of conceptual overhead is more than lay- people are willing to deal with.

<comment><USER20> You said: "I think it has to be a part of a large _service_."

My question was about the size of the _network_.

In any event, following your line of thought, do you think it's possible to have a many _small_, separate networks that were somehow part of a large service?

Regardless of your answer, does our solution have to be a "service"?

What if it is a "product" that creates small networks as overlays on a larger, existing network such as the one all your friends are connected to: the internet?

You said: "I can see that it's possible to create a service around, say, PGP..."

What if you could see that it's possible to create a service (or product, or both) around, say, a scheme that involved only a single shared password and a single shared encryption key? That is, each friend has to remember only two strings for each network to which she belongs, sort of like, say, a username and password.

What if you could see that such a scheme might not require logging on and logging out as frequently as a web-based service such as Facebook?

Would that change your thoughts at all?

You said, when referring to a PKI scheme like PGP: "But I think that [the] level of conceptual overhead is more than lay-people are willing to deal with."

I once thought the same thing about Amazon's S3 service. When I saw the Dropbox product, my thoughts changed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I need more enemies! I want to try this out!</comment>